A malware analyst is preparing to analyze a sample that is believed to be part of a targeted attack against a financial institution. The sample contains what appears to be customer account numbers. The analyst wants to use an AI-based tool that requires uploading the sample to a cloud service. The organization has a strict policy that customer data must not leave the organization's premises. What is the best course of action?

Use an on-premises AI-based analysis tool that does not require uploading the sample.

Upload the sample to the cloud service but remove the customer account numbers first.

Upload the sample to the cloud service and rely on the service's privacy policy.

Perform only manual analysis and avoid using AI tools.

An incident response team is using an AI-based system that automatically prioritizes incidents based on potential business impact. During a major incident, the system prioritizes a low-impact incident over a high-impact one because the low-impact incident has a higher confidence score. What is the best way to handle this?

Retrain the AI model immediately with new data

Follow the AI's prioritization because it is based on data

Override the AI's prioritization and manually handle the high-impact incident first

Disable the AI system and rely on manual prioritization

A malware analyst is using an AI-based tool that automatically generates YARA rules from malware samples. The tool has access to a repository of malware samples that includes sensitive data from a breach. The analyst wants to share the generated YARA rules with a public threat intelligence platform. What is the most important consideration?

Only share the YARA rules if the AI tool is open source

Do not share the YARA rules because they are too specific

Ensure the YARA rules do not contain any sensitive data from the samples

Share the YARA rules immediately because they are automated outputs

A security analyst receives a suspicious executable from an internal user. The file is not yet detected by antivirus. The analyst needs to determine whether the binary is packed or obfuscated before deciding to run it in a sandbox. Which static analysis step would provide the most direct evidence of packing?

Run the binary in a controlled sandbox and capture API calls

Compute the SHA-256 hash and query VirusTotal

Inspect the PE section names and entropy values

Check the file's digital signature and publisher

Which legal consideration is most relevant when using AI tools to analyze malware samples?

Ensuring the AI tool never makes mistakes

Guaranteeing the AI tool is open source

Obtaining a warrant for every analysis

Ensuring compliance with data protection laws when processing sample data

GIAC Certified Incident Handler

Domain 1Objective 3

Malware and AI Assisted Investigations GCIH Practice Questions (Page 3)

Part of the Incident Response and Investigation domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 6–11 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

7concepts

Questions 11–15

11expert · hard
A malware analyst is preparing to analyze a sample that is believed to be part of a targeted attack against a financial institution. The sample contains what appears to be customer account numbers. The analyst wants to use an AI-based tool that requires uploading the sample to a cloud service. The organization has a strict policy that customer data must not leave the organization's premises. What is the best course of action?
Select an answer first
12expert · hard
An incident response team is using an AI-based system that automatically prioritizes incidents based on potential business impact. During a major incident, the system prioritizes a low-impact incident over a high-impact one because the low-impact incident has a higher confidence score. What is the best way to handle this?
Select an answer first
13expert · hard
A malware analyst is using an AI-based tool that automatically generates YARA rules from malware samples. The tool has access to a repository of malware samples that includes sensitive data from a breach. The analyst wants to share the generated YARA rules with a public threat intelligence platform. What is the most important consideration?
Select an answer first
14application · medium
A security analyst receives a suspicious executable from an internal user. The file is not yet detected by antivirus. The analyst needs to determine whether the binary is packed or obfuscated before deciding to run it in a sandbox. Which static analysis step would provide the most direct evidence of packing?
Select an answer first
15foundation · easy
Which legal consideration is most relevant when using AI tools to analyze malware samples?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCIH” is a trademark of its owner, used for identification only.

Malware and AI Assisted Investigations GCIH Practice Questions (Page 3)

Questions 11–15

Which legal consideration is most relevant when using AI tools to analyze malware samples?

Keep studying — Incident Response and Investigation